A potentially dangerous Request.Path value was det

Question

I am receiving the rather self explanatory error:

A potentially dangerous Request.Path value was detected from the client (*).

The issue is due to * in the request URL:

https://stackoverflow.com/Search/test*/0/1/10/1

This url is used to populate a search page where 'test*' is the search term and the rest of the url relates to various other filters.

Is there an easy way to allow these special characters in the URL? I've tried modifying the web.config, to no avail.

Should I manually encode / decode the special characters? Or is there a best practice for doing this, I would like to avoid using query strings. - but it may be an option.

The application itself is a c# asp.net webforms application that uses routing to produce the nice URL above.

Answer 1

If you're using .NET 4.0 you should be able to allow these urls via the web.config

<system.web>
    <httpRuntime requestPathInvalidCharacters="&lt;,&gt;,%,&amp;,:,\,?" />
</system.web>

Note, I've just removed the asterisk (*), the original default string is:

<httpRuntime requestPathInvalidCharacters="&lt;,&gt;,*,%,&amp;,:,\,?" />

See this question for more details.

Answer 2

When dealing with Uniform Resource Locator(URL) s there are certain syntax standards, in this particular situation we are dealing with Reserved Characters.

As up to RFC 3986, Reserved Characters may (or may not) be defined as delimiters by the generic syntax, by each scheme-specific syntax, or by the implementation-specific syntax of a URI's dereferencing algorithm; And asterisk(*) is a Reserved Character.

The best practice is to use Unreserved Characters in URLs or you can try encoding it using java.net.URLEncoder.

Keep digging :

• Java URL encoding of query string parameters
• HTML URL Encoding Reference (w3schools)
• When to Encode or Decode (RFC 3986)
• How to extract parameters from a given url

Answer 3

The * character is not allowed in the path of the URL, but there is no problem using it in the query string:

http://localhost:3286/Search/?q=test*

It's not an encoding issue, the * character has no special meaning in an URL, so it doesn't matter if you URL encode it or not. You would need to encode it using a different scheme, and then decode it.

For example using an arbitrary character as escape character:

query = query.Replace("x", "xxx").Replace("y", "xxy").Replace("*", "xyy");

And decoding:

query = query.Replace("xyy", "*").Replace("xxy", "y").Replace("xxx", "x");

Answer 4

This exception occurred in my application and was rather misleading.

It was thrown when I was calling an .aspx page Web Method using an ajax method call, passing a JSON array object. The Web Page method signature contained an array of a strongly-typed .NET object, OrderDetails. The Actual_Qty property was defined as an int, and the JSON object Actual_Qty property contained "4 " (extra space character). After removing the extra space, the conversion was made possible, the Web Page method was successfully reached by the ajax call.

Answer 5

You should encode the route value and then (if required) decode the value before searching.

Answer 6

Try to set web project's server propery as Local IIS if it is IIS Express. Be sure if project url is right and create virual directory.